PT-2026-50448 · Openstack · Openstack Horizon

Tim Shephard · CVE-2026-55748 · Published 2026-06-17 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions OpenStack Horizon versions prior to 25.7.4

Description OpenStack Horizon produces scripts for OpenStack RC file downloading that may contain a crafted project name with shell metacharacters. Shell metacharacters are special characters interpreted by the command-line shell to perform specific actions, which could lead to unintended command execution if not properly handled.

Recommendations Update to version 25.7.4.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-55748

GHSA-6WRM-X65G-HR4P

PYSEC-2026-2519

Affected Products

Openstack Horizon

References · 14

• https://ubuntu.com/security/CVE-2026-55748 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6wrm-x65g-hr4p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-55748 · Security Note
• https://osv.dev/vulnerability/PYSEC-2026-2519 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-55748 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-55748 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-55748 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-55748 · Vendor Advisory
• https://github.com/openstack/horizon · Note
• https://t.me/cveNotify/169483 · Telegram Post
• https://launchpad.net/bugs/2152240 · Note
• https://github.com/advisories/GHSA-6wrm-x65g-hr4p · Note
• https://pypi.org/project/horizon · Note
• https://wiki.openstack.org/wiki/OSSN/OSSN-0097 · Note